chore(deps): bump the python-dependencies group across 1 directory with 6 updates

[dependabot]

Bumps the python-dependencies group with 6 updates in the / directory:

Package	From	To
pydantic-settings	2.14.2	2.15.0
sqlglot	30.14.0	30.17.0
clickhouse-connect	1.6.0	1.7.2
uvicorn	0.52.0	0.52.4
ruff	0.16.0	0.16.4
pre-commit	4.6.1	4.6.2

Updates pydantic-settings from 2.14.2 to 2.15.0

Release notes

Sourced from pydantic-settings's releases.

v2.15.0

Highlights

Behavior changes

• case_sensitive now applies to init kwargs and config-file sources (#900). InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.
• Fields with unresolved forward references now emit a warning (#901). Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.
• Non-JSON env values for strict fields now raise ValidationError (#926) instead of a less specific error.

New features

• Show environment variable names in CLI help via cli_show_env_vars=True (#860), so generated --help output doubles as configuration documentation.
• PYDANTIC_SETTINGS_DEBUG for debugging settings resolution (#906, #913). Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.
• toml_table_header for regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not just pyproject.toml.
• Traversable support for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.
• GCP: project_id can come from an earlier settings source (#878), rather than only from the constructor or GOOGLE_CLOUD_PROJECT.

Bug fixes

• Fix env vars not loading on Windows with case_sensitive=True (#894). Windows upper-cases os.environ keys, so fields raised Field required instead of picking up their values.
• Read secret files as UTF-8 instead of the platform locale encoding (#917). On Windows code pages such as cp1252 this silently corrupted non-ASCII secrets.
• Fix AliasPath on nested model fields not JSON-decoding env values (#898).
• Fix case-insensitive matching for optional nested models (#905).
• Fix dotenv extras being wrongly claimed by a complex field sharing a name prefix (#912) — e.g. dbx_token being swallowed by a db: dict field.
• Fix nested_model_default_partial_update=True corrupting discriminated unions (#876).
• Fix Secret subclasses crashing when loaded from the environment (#920).
• Fix enum names not parsing through nested annotations such as Optional[Annotated[MyEnum, ...]] with env_parse_enums=True (#910).
• An empty yaml_config_section now falls back to defaults instead of raising AttributeError: 'NoneType' object has no attribute 'keys' (#914).
• NestedSecretsSettingsSource no longer follows symlinks pointing outside secrets_dir (#889).
• GCP: skip the list_secrets call when case_sensitive=True (#862), lowering the required IAM permissions to just roles/secretmanager.secretAccessor.
• AWS: types-boto3[secretsmanager] is no longer required at runtime (#880).

Documentation

• Document JSON parsing of complex env values, plus a comma-separated-values recipe (#919).
• Recommend an async settings loading pattern (#908).
• Clarify behavior when an unprefixed value is present in a dotenv file (#895).
• Clarify environment variable helper descriptions (#867) and fix assorted typos (#904).

What's Changed

• Update documentation link for Pydantic settings by @​hramezani in pydantic/pydantic-settings#863
• Bump the python-packages group with 4 updates by @​dependabot[bot] in pydantic/pydantic-settings#865
• docs: clarify environment variable helper descriptions by @​vip892766gma in pydantic/pydantic-settings#867
• Bump the python-packages group with 4 updates by @​dependabot[bot] in pydantic/pydantic-settings#870
• Bump the python-packages group with 4 updates by @​dependabot[bot] in pydantic/pydantic-settings#875
• Skip list_secrets call when case_sensitive=True by @​ecerulm in pydantic/pydantic-settings#862
• GoogleSecretManagerSettingsSource: read project_id from previous sources by @​ecerulm in pydantic/pydantic-settings#878

... (truncated)

Commits

• f725ca1 Prepare release 2.15.0 (#930)
• 28f35c2 Bump the python-packages group with 4 updates (#929)
• 9056db0 test: move function-local imports to the top of test modules (#927)
• f077e3a fix: raise ValidationError for non-JSON env values on strict fields (#926)
• ae25d70 fix: treat Secret subclasses as non-complex fields (#716) (#920)
• 798dcea Bump the python-packages group with 4 updates (#924)
• a190041 Bump the github-actions group with 4 updates (#925)
• 5d93332 Bump the python-packages group with 4 updates (#921)
• d2fdeda fix: read secret files as UTF-8 instead of the locale encoding (#917)
• 2256a4e Bump the python-packages group with 3 updates (#915)
• Additional commits viewable in compare view

Updates sqlglot from 30.14.0 to 30.17.0

Commits

• 9a8129b feat(executor): implement LENGTH [CLAUDE] (#8145)
• b7386b7 fix(optimizer)!: scope DML / DDL query fragments properly (#8140)
• 8619582 fix(optimizer): preserve identifier meta when restoring JSON dot part case
• 98f3d66 feat(executor): implement ILIKE [CLAUDE] (#8144)
• 44b73a0 Fix(executor): fullmatch like semantics
• 7cab581 fix(executor): honor the negate flag on LIKE and ILIKE [CLAUDE] (#8139)
• 1dae76b fix(executor): only truncate typed division when both operands are integers [...
• 3a76dfd feat(optimizer)!: annotate encode for postgresql (#8137)
• 9312212 Fix(optimizer)!: properly support UNION BY NAME in qualify, type inference ...
• 8ba0435 fix(optimizer)!: escape gen delimited names (strings, etc) (#8134)
• Additional commits viewable in compare view

Updates clickhouse-connect from 1.6.0 to 1.7.2

Release notes

Sourced from clickhouse-connect's releases.

v1.7.2

clickhouse-connect v1.7.2

This patch release fixes SQLAlchemy reflection and SQL generation, query formatting, server-side parameter names, and HTTP proxy path handling.

What's Changed

Bug Fixes

• SQLAlchemy inspectors bound to an Engine now support get_columns() and reflect_table() on SQLAlchemy 2.x. Reflection also honors include_columns and exclude_columns. Closes #967.
• Queries ending with a semicolon, whitespace, or trailing comment now place client-appended FORMAT clauses correctly. Insert detection also follows SQL token rules. Closes #903.
• The async client now preserves explicit proxy_path values without adding extra slashes. Closes #963.
• The synchronous client now sends a normalized / request path through forwarding HTTP proxies when no proxy_path is configured. Closes #951.
• Server-side query placeholders now recognize $ in valid parameter names while preserving raw binary binding and ambiguity checks. Closes #936.
• SQLAlchemy ClickHouse types now implement the public literal processor contract for TypeDecorator and with_variant(). Closes #965.
• SQLAlchemy literals containing percent signs now compile safely alongside bound parameters and in server-side parameter mode. Closes #966.
• SQLAlchemy now applies ClickHouse backslash escaping to generic literal strings, defaults, aliases, TTL clauses, comments, and Alembic comment operations. Custom pre-escaping workarounds should be removed. Closes #975.
• SQLAlchemy union(), intersect(), and except_() now emit explicit DISTINCT operations. Use the corresponding _all() methods when duplicate-preserving behavior is required. Closes #973.
• SQLAlchemy Select.with_hint() now emits SAWarning when an applicable table hint would otherwise be ignored. Generated SQL remains unchanged. Closes #974.

Full Changelog: v1.7.1...v1.7.2

Installation

pip install clickhouse-connect

v1.7.1

clickhouse-connect v1.7.1

This is a patch release with two SQLAlchemy compatibility fixes.

What's Changed

Bug Fixes

• SQLAlchemy 2.1 compatibility: Identifier quoting forwarded the deprecated force argument to IdentifierPreparer.quote, which SQLAlchemy 2.1 removed, causing any dialect use to raise TypeError on 2.1.0b3. The parent call now passes only the identifier. The optional force parameter remains available on the ClickHouse preparer for direct callers. Closes #954.
• SQLAlchemy 1.4 compatibility: Column DDL using the clickhouse_materialized, clickhouse_alias, or clickhouse_ttl options raised AttributeError on SQLAlchemy 1.4 because it called a rendering helper that only exists in 2.0. The helper is now implemented locally. This appears to have been broken since 1.1.0.

Full Changelog: ClickHouse/clickhouse-connect@v1.7.0...v1.7.1

Installation

pip install clickhouse-connect

v1.7.0

clickhouse-connect 1.7.0

... (truncated)

Changelog

Sourced from clickhouse-connect's changelog.

1.7.2, 2026-08-19

Bug Fixes

• SQLAlchemy inspectors bound to an Engine can now call get_columns() and reflect_table() directly on SQLAlchemy 2.x. These methods now acquire and reuse one connection for each reflection operation, while inspectors already bound to a Connection continue to reuse it. Table reflection also honors positional include_columns and exclude_columns filters passed by SQLAlchemy instead of silently reflecting every column. Closes #967.
• Queries ending in a semicolon now keep the client-appended FORMAT clause inside the statement, including when the semicolon is followed by whitespace or a trailing comment. This fixes query, query_arrow, and raw_query with fmt for both sync and async clients. A lone directly trailing semicolon keeps the existing fast binding path, and inserts carrying inline data are never passed through the SQL lexer. Insert detection now follows SQL token rules, so quoted text such as ' INSERT INTO ' in a SELECT no longer misroutes the query, and identifiers named insert are not mistaken for the keyword. Closes #903.
• The async client now preserves an explicit proxy_path when constructing request URLs. It previously appended / unconditionally, changing /clickhouse to /clickhouse/ and /clickhouse/ to /clickhouse//, which could break exact-path proxy routing. Bare authority URLs still use /. Closes #963.
• The synchronous client now normalizes an empty request path to / when no proxy_path is configured, so requests routed through a forwarding HTTP proxy (http_proxy/HTTP_PROXY) use the normal absolute-form request-target (http://host:8123/?query=...) instead of the RFC-valid but non-normalized http://host:8123?query=..., which some proxies reject with HTTP 400 and others forward with the query string silently dropped. Direct connections are unaffected because urllib3 already normalizes the empty path, and an explicit proxy_path is left exactly as-is. This matches the async client, which already sent the path. Closes #951.
• Query placeholders now recognize $ in server-valid parameter names such as {id$x:Int32} or {$x$:String}. Previously these names were missed, which omitted their server-side values and could also drop DateTime64 precision and timezone hints. Placeholder detection is otherwise unchanged from 1.x. A $name$ dictionary key with a buffer value such as bytes, bytearray, or memoryview stays a raw binary bind. A non-buffer value for such a key can bind through a single {name:Type} placeholder, and ambiguous or repeated uses of the name raise ProgrammingError. SQLAlchemy server_side_params accepts the same names and rejects the reserved $name$ form. Closes #936.
• SQLAlchemy ClickHouse types now implement the public literal processor contract, so TypeDecorator wrappers and with_variant() render ClickHouse literals with proper quoting and escaping. Closes #965.
• SQLAlchemy ClickHouse type literals containing percent signs now compile safely alongside remaining bound parameters, and server-side parameter mode preserves consecutive percent signs in literals. Closes #966.
• SQLAlchemy now applies ClickHouse backslash escaping to generic literal_binds strings, string DEFAULT, MATERIALIZED, ALIAS, and TTL clauses, CREATE comments, and Alembic table and column comment operations. Backslash values now round-trip verbatim instead of being reinterpreted or terminating a quoted literal. ClickHouse-native literal processors and percent handling are unchanged. If custom TypeDecorator.process_literal_param or UserDefinedType code pre-escaped backslashes as a workaround, remove that workaround because the dialect now applies ClickHouse escaping. Closes #975.
• SQLAlchemy union(), intersect(), and except_() now compile to explicit UNION DISTINCT, INTERSECT DISTINCT, and EXCEPT DISTINCT, preserving SQLAlchemy's duplicate-removing semantics instead of relying on ClickHouse defaults. Their union_all(), intersect_all(), and except_all() counterparts remain explicit ALL operations. Users relying on previous duplicate-preserving behavior from union_default_mode='ALL' or ClickHouse's default intersect_default_mode='ALL' and except_default_mode='ALL' should switch to the corresponding _all() method. Closes #973.
• SQLAlchemy Select.with_hint() now emits an SAWarning when an applicable table hint would otherwise be silently ignored. The generated SQL remains unchanged for 1.x compatibility. Applications that promote SAWarning to an error will now stop at compilation instead of executing without the requested hint. Use the typed final(), sample(), prewhere(), and limit_by() methods for those ClickHouse clauses. Raw with_statement_hint() tail directives remain supported. Closes #974.

1.7.1, 2026-08-12

Bug Fixes

• SQLAlchemy 2.1 compatibility. Identifier quoting forwarded the deprecated force argument to IdentifierPreparer.quote, which SQLAlchemy 2.1 removed, so any dialect use raised TypeError on 2.1.0b3. The parent call now passes only the identifier. The optional force parameter stays on the ClickHouse preparer for direct callers. Closes #954.
• SQLAlchemy 1.4 compatibility. Column DDL using the clickhouse_materialized, clickhouse_alias, or clickhouse_ttl options raised AttributeError on SQLAlchemy 1.4 because it called a rendering helper that only exists in 2.0. The helper is now implemented locally. This appears to have been broken since 1.1.0.

1.7.0, 2026-08-11

Improvements

• SQLAlchemy JSON columns now support storage-backed subcolumn access with column["segment"], column.subcolumn("segment", type_=...), and the statically typed json_subcolumn(...) helper. Nested paths compile as independently quoted dotted identifiers, and typed access uses CAST. Closes #899.
• show_clickhouse_errors now accepts "scrub" in addition to True/False. Scrub mode keeps the SQL exception text and symbolic name (for example UNKNOWN_TABLE) while stripping the server URL and trailing (version ...) trailer from client exception messages. Transport errors and mid-stream StreamFailureError messages honor the same setting. When error detail is disabled (False), the displayed exception string is generic. The chDB backend now uses the same generic text as HTTP, without its former trailing period. This setting governs str(exc) only. Transport errors remain attached as __cause__, so tracebacks can still contain the original host, URL, or library error text. Historical string booleans still work, but non-boolean values such as integers and unrecognized strings now raise ProgrammingError. Addresses the middle ground requested in #344.
• SQLAlchemy: added support for materialized common table expressions. cc_sqlalchemy.select(...).cte("name", materialized=True) emits WITH name AS MATERIALIZED (...), so a CTE referenced more than once is computed once instead of being inlined and re-executed at each reference. A module-level cc_sqlalchemy.cte(statement, "name", materialized=True) does the same for a statement built with the standard sqlalchemy.select. The keyword renders only on the ClickHouse dialect. The server materializes the CTE only when the experimental enable_materialized_cte setting is also enabled for the query and the analyzer is enabled. Materialized CTEs require ClickHouse 26.3 or later. The SQLAlchemy helpers reject recursive=True with materialized=True because ClickHouse does not support recursive materialized CTEs. Closes #900.
• Added the global naive_datetime_insert setting for Python object inserts, including naive ISO strings accepted by DateTime64. Set it to "server" to interpret a naive datetime in the timezone declared by the DateTime or DateTime64 column, or in the server timezone when the column has no timezone. The default remains "local" in 1.x and preserves the existing host-local conversion. This setting does not change datetime64-dtype NumPy and Pandas columns. Use naive_datetime_binding to control naive datetime query parameters. See #938.

Behavior Changes

• Removed runtime compatibility branches for unsupported ClickHouse server versions older than 25.8. Client initialization no longer substitutes the common.readonly value for servers older than 19.17 and always attempts guarded Native protocol negotiation, retaining the existing proxy-safe fallback. JSON inserts no longer fall back to String serialization for 24.8 and 24.9 servers. The module attribute clickhouse_connect.datatypes.dynamic.json_serialization_format remains importable for compatibility but assigning it no longer changes insert behavior. The generated cast_string_to_dynamic_use_inference default no longer depends on the obsolete allow_experimental_json_type setting. The global common.readonly option is deprecated and retained as a no-op. The default local Docker server is now ClickHouse 25.8.
• datetime.time and datetime.timedelta query parameters are now rendered as quoted literals. A time value was previously rendered without quotes and the server rejected it, so some queries added the quotes in the query text as a workaround, for example WHERE t = '%(t)s'. Those queries now produce a doubled quote and fail. Remove the manual quotes and bind the value normally. See #919.
• Naive datetime query parameters now bind as wall time instead of being interpreted in the client host timezone. Previously a naive value passed through astimezone for server-side {name:DateTime} parameters and DT64Param values, so the same query could match different rows depending on the timezone of the machine running it. Only workloads that bind naive datetime parameters with a non-UTC host timezone or a non-UTC target timezone are affected. Environments where both the host and the bind target are UTC see no change, and client-side % parameters against a UTC server were already sent verbatim. Two changes are observable. First, on a non-UTC host with a UTC target, server-side parameters and DT64Param values no longer shift, which corrects silently wrong results. Second, when the bind target is a non-UTC timezone, a naive value now means wall time in that timezone instead of the instant implied by the client local timezone, which can change matched rows for code that relied on the old conversion. A related consequence is that inserting a naive datetime and then filtering with the same naive value no longer matches on a non-UTC host, because the insert path still interprets naive values as host local time. #938 tracks unifying insert semantics. Timezone-aware datetimes are unchanged and still convert to the target bind timezone. Set common.set_setting("naive_datetime_binding", "legacy") to restore the previous behavior exactly. To make a naive value represent a specific instant under either mode, attach the intended tzinfo before binding.

Bug Fixes

• SQLAlchemy identifiers containing % now compile safely in statements with bound parameters. The DB-API bulk INSERT path also restores escaped percent signs in table and column names, so executemany keeps using one bulk insert instead of falling back to row-by-row execution or sending the wrong identifier. This includes %2E JSON key encodings used with json_type_escape_dots_in_keys.
• datetime.time and datetime.timedelta query parameters now bind as a quoted HH:MM:SS[.ffffff] literal for Time and Time64 columns. This fixes client-side %(name)s binding, timezone-aware time values, timedelta values, and values nested in arrays and tuples. A naive scalar time at the top level of a server-side {name:Time} bind already worked and is unchanged. A timedelta may be negative and may exceed 24 hours, and a pandas Timedelta with sub-microsecond nanoseconds formats a nine digit fraction. Plain Time accepts only whole seconds. Addresses the Time parameter failure in #919.
• SQLAlchemy: Time and Time64 columns now accept datetime.time and datetime.timedelta values in inserts and comparisons, and render correctly with literal_binds. The types inherit from the SQLAlchemy Interval type, which converted every bound value to an epoch datetime that the server rejected and coerced comparison values to its DateTime implementation. Reads still return timedelta. Part of #919.
• DB API module now provides the PEP 249 type constructors Binary, Date, Time, Timestamp, DateFromTicks, TimeFromTicks, and TimestampFromTicks. SQLAlchemy LargeBinary inserts no longer raise AttributeError. Addresses the Binary constructor failure in #919.
• Fractional DateTime64 values before the Unix epoch now serialize with the correct second. The serializer truncated negative timestamps toward zero before adding the fractional component, which shifted affected values forward by one second. This affected Python datetime values and accepted ISO strings in both naive datetime insert modes. See #938.
• Parsing a nested Variant, Tuple, Nested, or typed JSON column type whose element is an Enum with an escaped single quote in a value name no longer corrupts the escape sequence and fails while re-parsing the element type. Closes #878.
• None nested inside an Array or Tuple, or inside a Map when dict_parameter_format="map", now renders as the SQL NULL keyword instead of the \N sentinel used for top-level values. Top-level scalar None binds are unchanged. Closes #879.
• Inserting empty bytes b"" into a non-nullable FixedString(N) column now zero-pads to N bytes instead of raising DataError, matching the existing string and nullable-bytes write paths. Closes #880.
• Per-query and client settings that are not present in system.settings for the current user (including custom settings declared CHANGEABLE_IN_READONLY on a role) are now forwarded to ClickHouse instead of raising ProgrammingError: Setting ... is unknown or readonly. The client cannot discover those settings without extra privileges, so the server is treated as authoritative. Setting invalid_setting_action to drop still drops them, so a single settings dict stays portable across server versions. Known readonly settings still honor invalid_setting_action, and reserved HTTP request parameter names such as query, user, default_format, and the param_ bound-parameter namespace still raise a client-side ProgrammingError because they are not settings. Closes #530.
• SQLAlchemy reflection and metadata queries now force internal String decoding, so set_default_formats("String", "bytes") no longer turns reflected database, table, or column names into bytes. The Alembic startup current database lookup uses the same internal format. Alembic version table queries do not use the internal override and remain affected by a global String bytes format. Closes #920.
• Removing a block comment for query type detection no longer joins the tokens around it. The server lexer treats a comment as a token separator, but remove_sql_comments replaced it with nothing, so SELECT/*c*/number FROM numbers(9) became the single token SELECTnumber, stopped looking like a SELECT, and the client side query_limit was silently dropped, while SELECT number FROM numbers(9)/*c*/LIMIT 1 became numbers(9)LIMIT 1, hid the real LIMIT, and the client appended a second one that the server rejected with Code: 62. A removed block comment now leaves a single space behind, and the trailing LIMIT 0 check that routes a query to the columns only metadata probe accepts any whitespace between LIMIT and 0 instead of exactly one space, so LIMIT /*c*/0 keeps reaching that probe. A -- line comment is unchanged, its terminating newline was already kept. Closes #928.

... (truncated)

Commits

• 9283654 release prep for 1.7.2 (#980)
• 836e12e fix SQLAlchemy engine-bound table reflection (#979)
• 1b7b0af fix SQLAlchemy DISTINCT set operations (#978)
• c76037d warn on ignored SQLAlchemy table hints (#977)
• 6ca829b Joe/fix arrow trailing semicolon (#970)
• f110acc update review instructions and arch metadata (#976)
• 289f42a Fix SQLAlchemy DDL string literal escaping for comments and string defaults (...
• 9c24d33 Joe/fix chsqlatype literal bugs (#969)
• 2f34aa5 use centralized docs drift checker (#961)
• 8e15d09 async explicit proxy_path preservation (#964)
• Additional commits viewable in compare view

Updates uvicorn from 0.52.0 to 0.52.4

Release notes

Sourced from uvicorn's releases.

Version 0.52.4

Fixed

• Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

Full Changelog: Kludex/uvicorn@0.52.3...0.52.4

Version 0.52.3

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

Full Changelog: Kludex/uvicorn@0.52.2...0.52.3

Version 0.52.2

Fixed

• Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

Full Changelog: Kludex/uvicorn@0.52.1...0.52.2

Version 0.52.1

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
• Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

Full Changelog: Kludex/uvicorn@0.52.0...0.52.1

Changelog

Sourced from uvicorn's changelog.

0.52.4 (August 18, 2026)

Fixed

• Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

0.52.3 (August 13, 2026)

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

• Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

0.52.1 (August 1, 2026)

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
• Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

Commits

• 8988c23 Stabilize macOS Python 3.13 signal shutdown tests (#3084)
• 898ddca Update PyPI publish action to version 1.14.2 (#3083)
• 3869f8a Restore Mermaid diagram rendering (#3080)
• 64148a9 Version 0.52.4 (#3079)
• 9e9e569 docs: correct release example PR number (#3072)
• b783dac Remove duplicate Date header from SansIO WebSocket handshakes (#3078)
• 27019b2 chore(deps): bump the python-packages group across 1 directory with 11 update...
• 1b64273 Fix a typo in index.md (#3006)
• a68da60 Version 0.52.3 (#3068)
• 6e3bb4c Use zttp 0.0.24 fast receive path (#3067)
• Additional commits viewable in compare view

Updates ruff from 0.16.0 to 0.16.4

Release notes

Sourced from ruff's releases.

0.16.4

Release Notes

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

• [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
• [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
• [syntax-errors] Detect duplicate keyword arguments (#17804)
• [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

• Offer display-only fixes and mark safe fixes preferred (#27807)
• Support pull diagnostics for notebook cells (#27779)

Documentation

• Add default indicator to rules table (#27724)
• Fix broken link to Python docs (#27757)

Other changes

• Fix s390x stacker assembly in release builds (#27776)
• Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
• Reduce configuration deserialization code size (#27924)
• Check packed AST index bounds (#27849)

Contributors

• @​AbhinavMir
• @​eduardorittner
• @​royb3
• @​MichaReiser
• @​carljm
• @​rosstitmarsh
• @​ntBre

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.4

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

• [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
• [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
• [syntax-errors] Detect duplicate keyword arguments (#17804)
• [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

• Offer display-only fixes and mark safe fixes preferred (#27807)
• Support pull diagnostics for notebook cells (#27779)

Documentation

• Add default indicator to rules table (#27724)
• Fix broken link to Python docs (#27757)

Other changes

• Fix s390x stacker assembly in release builds (#27776)
• Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
• Reduce configuration deserialization code size (#27924)
• Check packed AST index bounds (#27849)

Contributors

• @​AbhinavMir
• @​eduardorittner
• @​royb3
• @​MichaReiser
• @​carljm
• @​rosstitmarsh
• @​ntBre
• @​zaniebot

... (truncated)

Commits

• 11c76bf Bump 0.16.4 (#27937)
• d53c8c5 Isolate playground builds from deployment credentials (#27839)
• cab001e Disable uv preview for releases and pre-commit hooks (#27939)
• f8d575f [ty] Clarify writing guidance for human readers (#27912)
• ca45fae Set --preview and --default-index for the uv-lock hook (#27935)
• 4827bf7 Export UV_DEFAULT_INDEX in release.sh (#27934)
• d1087a4 [ty] Handle assignment expressions in string annotations (#27921)
• 680cce4 [ty] Optimize inherited recursive protocol comparisons (#27922)
• 974d3cb Upgrade ecosystem-analyzer and mypy_primer to the latest upstream pins (#27932)
• b169b40 Install cargo tools locked (#27929)
• Additional commits viewable in compare view

Updates pre-commit from 4.6.1 to 4.6.2

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.2

Fixes

• Fix language: node hooks that contain "scripts": {"build": ...} with npm 11.x.
  • Regressed in 4.6.1.
  • #3737 issue by @​mheiges.
  • #3743 PR by @​asottile.

Changelog

Sourced from pre-commit's changelog.

4.6.2 - 2026-08-10

Fixes

• Fix language: node hooks that contain "scripts": {"build": ...} with npm 11.x.
  • Regressed in 4.6.1.
  • #3737 issue by @​mheiges.
  • #3743 PR by @​asottile.

Commits

• 9767b6c v4.6.2
• 42ee3ff Merge pull request #3743 from pre-commit/npm-build-scripts-11-x
• 3056619 fix language: node for hooks with build scripts and npm 11.x
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific ...

Description has been truncated